Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2013-4576
2.1
LOWCVSS v2
Published
December 20, 2013
Affected
1 project
Assigned by
Red Hat
Severity scale
010
Description
GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.
gpg/gnupg
GitHubThe GNU Privacy Guard. NOTE: Maintainers are not tracking this mirror. Do not make pull requests here, nor comment any commits, submit them usual way to bug tracker (https://www.gnupg.org/documentation/bts.html) or to the mailing list (https://www.gnupg.org/documentation/mailing-lists.html).
GitHubThe GNU Privacy Guard. NOTE: Maintainers are not tracking this mirror. Do not make pull requests here, nor comment any commits, submit them usual way to bug tracker (https://www.gnupg.org/documentation/bts.html) or to the mailing list (https://www.gnupg.org/documentation/mailing-lists.html).= 1.4.8, = 1.2.3, = 1.3.3, = 1.0.1, = 1.3.1, = 1.2.6, = 1.4.14, = 1.3.93, = 1.3.2, = 1.2.2, = 1.3.4, = 1.4.0, = 1.4.10, = 1.4.4, <= 1.4.15, = 1.0.0, = 1.2.5, = 1.4.12, = 1.4.6, = 1.0.4, = 1.2.1, = 1.4, = 1.0.2, = 1.0.7, = 1.3.91, = 1.3.92, = 1.4.13, = 1.0.5, = 1.4.5, = 1.0.6, = 1.2.4, = 1.3.6, = 1.3.90, = 1.4.11, = 1.0.3, = 1.3.0, = 1.4.2, = 1.4.3, = 1.2.0, = 1.2.7NVD